Download free trial version

New features

iCloud Messages and Attachments

iOS 11.4 adds long-awaited support for message sync through iCloud. Elcomsoft Phone Breaker is the first tool on the market to extract and decrypt messages from iCloud complete with additional content: pictures, videos, documents and other attachments. To access iCloud Messages, the login and password to the user's Apple Account, one-time code to pass Two-Factor Authentication and a screen lock password or system password for one of the already enrolled devices are required.

Faster Access to iCloud Files

Elcomsoft Phone Breaker 8.30 significantly speeds up access to accounts with large numbers of files and folders (e.g. accounts that sync with Mac Documents or Desktop). As a result, detailed file system structure will be no longer displayed at the time of acquisition.

Logical Acquisition of Mobile Devices

Elcomsoft Phone Breaker enables forensic access to information stored in a wide range of mobile devices. The tool delivers logical acquisition for Apple iOS devices, BlackBerry OS and BlackBerry 10 smartphones, as well as devices powered by Windows 10, Windows Phone and Windows 10 Mobile operating systems. Acquisition of local and cloud backups as well as cloud extraction of synchronized data are available.

Decrypting iOS Backups

Decrypt password-protected local backups produced by Apple iPhone, iPad and iPod Touch devices. Hardware-accelerated attacks make use of existing AMD and NVIDIA video cards to speed up the recovery.

Cloud Acquisition via Apple iCloud and Microsoft Account

Cloud acquisition is a highly effective way of retrieving up-to-date information backed up or synced by modern smartphones with their respective cloud services. Elcomsoft Phone Breaker supports the extraction of cloud backups and synced data from Apple iCloud and Microsoft Account, enabling remote acquisition of iPhone and iPad devices as well as smartphones running Windows Phone and Windows 10 Mobile.

Online backups can be acquired by forensic specialists without having the original iOS or Windows Phone device in hands. All that’s needed to access online backups stored in the cloud service are the original user’s credentials including Apple ID or Live ID accompanied with the corresponding password.

If the user’s Apple ID and password are not available, Elcomsoft Phone Breaker can use a binary authentication token created by Apple iCloud Control Panel in order to login to iCloud and retrieve information. The use of authentication tokens allows bypassing two-factor authentication even if no access to the secondary authentication factor is available.

Acquiring iCloud Keychain

Elcomsoft Phone Breaker is the only tool on the market to access, extract and decrypt iCloud Keychain, Apple's cloud-based system for storing and syncing passwords, credit card data and other highly sensitive information across devices. As opposed to authorizing a new Apple device, Elcomsoft Phone Breaker does
not become part of the circle of trust and does not require a middleware device, thus offering truly forensic extraction of protected records.

Downloading Messages from iCloud

iOS 11.4 adds long-awaited support for message sync through iCloud. Elcomsoft Phone Breaker is the first tool on the market to extract and decrypt messages from iCloud complete with attachments. To access Messages, the login and password to the user's Apple Account, one-time code to pass Two-Factor Authentication and a screen lock password or system password for one of the already enrolled devices is required.

FileVault 2 Decrypting

Elcomsoft Phone Breaker can extract escrow decryption keys from the user’s Apple account, and make use of those keys to decrypt macOS FileVault 2 volumes even if user account password is not known.

Note: At this time, Elcomsoft Phone Breaker can only decrypt HFS+ volumes.

iCloud backups created with iOS 11.2 and newer are not supported for accounts with Two-Factor Authentication

All Features and Benefits

Elcomsoft Phone Breaker enables forensic access to password-protected backups for smartphones and portable devices based on RIM BlackBerry and Apple iOS platforms. The password recovery tool supports all Blackberry smartphones as well as Apple devices running iOS including iPhone, iPad and iPod Touch devices of all generations released to date, including the iPhone 8/Plus, iPhone X and iOS 11.

Cloud acquisition is a great way of retrieving information stored in mobile backups produced by Apple iOS, and a handy alternative when exploring Windows Phone, Windows 10 Mobile and desktop Windows 10 devices. Elcomsoft Phone Breaker can retrieve information from Apple iCloud and Microsoft Account provided that original user credentials for that account are known.

Online backups can be acquired by forensic specialists without having the original iOS or Windows device in hands. All that’s needed to access online backups stored in the cloud service are the original user’s credentials including Apple ID or Microsoft Account accompanied with the corresponding password.

Elcomsoft Phone Breaker supports accounts with Apple's two-step verification as well as the new two-factor authentication. Access to the second authentication factor such as a trusted device or recovery key is required. You will only need to use it once as Elcomsoft Phone Breaker can save authentication credentials for future sessions.

If the user’s Apple ID and password are not available, Elcomsoft Phone Breaker can use a binary authentication token created by Apple iCloud Control Panel in order to login to iCloud and retrieve information. The use of authentication tokens allows bypassing two-factor authentication even if no access to the secondary authentication factor is available.

The Forensic edition of Elcomsoft Phone Breaker comes with the ability to acquire and use authentication tokens from Windows and Mac OS X computers, hard drives or forensic disk images. Authentication tokens for all users of that computer can be extracted, including domain users (providing that their system logon passwords are known). The tools are available in both Windows and Mac versions of the tool.

Authentication tokens are obtained from the suspect’s computer on which the iCloud app is installed. In order for the token to be created, the user must have been logged in to iCloud Control Panel on that PC at the time of acquisition. Authentication tokens can be extracted from live systems (a running Mac OS or Windows PC) or retrieved from users’ hard drives or forensic disk images.

If the user forgets their account password, or if the encrypted volume is moved to a different computer, a FileVault 2 can be unlocked with a special Recovery Key. If the user logs in with their Apple ID credentials, the Recovery Key can be saved into the user’s iCloud account. Should the user forget their password, the system can automatically use the Recovery Key to unlock the encrypted volume. It is important to note that Apple does not allow the end user to view or extract FileVault 2 recovery keys from iCloud.

Elcomsoft Phone Breaker can extract FileVault 2 recovery keys from the user’s iCloud account, and use these keys to decrypt encrypted disk images. Valid authentication credentials (Apple ID/password or iCloud authentication token) as well as volume identification information extracted from the FileVault-encrypted disk image are required.

Note: this functionality is only available in Forensic edition. APFS volumes are not supported at this time.

iPhones automatically sync certain types of data with iCloud in real time. Elcomsoft Phone Breaker automatically downloads synced data including call logs, contacts, notes (included deleted notes and attachments), calendars as well as Web browsing activities including Safari history (including deleted records), bookmarks and open tabs. Unlike iCloud backups that may or may not be created on daily basis, synced information is pushed to Apple servers just minutes after the corresponding activity has taken place. Once uploaded, synced data can be retained for months with no option for the end user to clear the data or disable the syncing.

Elcomsoft Phone Breaker supports the following types of synced data:

Messages in iCloud: complete with media and file attachments

iCloud Keychain

Safari (browsing history, bookmarks, tabs opened on user's devices)

Calendars, notes, contacts

Call logs (information about calls made and received)

Apple Maps (routes, places, searches)

Wi-Fi (wireless access points, MAC addresses, date and device added)

Wallet (everything except payment data)

Account info (comprehensive information about the user and devices registered on the Apple ID account)

In addition to iCloud backups, Elcomsoft Phone Breaker can download files stored in the user’s iCloud account such as documents or spreadsheets, third-party application data (such as WhatsApp own backups, 1Password database, Passbook/Wallet data etc.), and more. Files from a synced Mac such as Desktop, Documents, and Trash can be extracted. Some of this data (mostly documents) is available using the iCloud feature on Windows and macOS systems, but most files are only accessible using Elcomsoft Phone Breaker. The exact set of data available may depend on the version of iOS installed, iCloud synchronization settings, the list of applications installed on the devices connected to the given account, and the options set in these applications. Note that there is no email notification sent by Apple when downloading files from iCloud.

Apple’s iCloud Photo Library is designed to help users store and synchronize media files between multiple devices. If iCloud Photo Library is enabled, media files are no longer saved to iOS iCloud backups. As a result, acquiring iCloud backups or downloading files stored in iCloud Drive does not automatically provide access to media files stored in the iCloud Photo Library.

Elcomsoft Phone Breaker can extract photos and videos stored in the user’s iCloud Photo Library. In addition to existing files, Elcomsoft Phone Breaker can extract media files that have been deleted from the Library during the past 30 days. Selective downloads are possible by specifying which user-created albums to download.

Local backups produced by BlackBerry Link are always encrypted with a highly secure hardware-specific encryption key, effectively preventing forensic analytic tools from processing BlackBerry 10 data. As even the original use has no control over the password protecting these backups, the only possible way of using these backups was restoring them onto a BlackBerry device with the same BlackBerry ID, making forensic analysis of these backups extremely cumbersome.

Elcomsoft Phone Breaker can effectively decrypt BlackBerry 10 backups produced with BlackBerry Link if the user’s BlackBerry ID and password are known.

Downloading a large backup for the very first time can potentially take hours. Subsequent updates are incremental, and occur much faster. If speed is essential, Elcomsoft Phone Breaker offers the ability to quickly acquire select information and skip data that’s taking the longest to download (such as music and videos). Information such as messages, attachments, phone settings, call logs, address books, notes, calendars, email account settings, camera roll, and many other pieces of information can be pre-selected and downloaded in just minutes, providing investigators with near real-time access to essential information.

ElcomSoft offers a highly efficient, cost-effective solution to lengthy attacks by dramatically increasing the speed of password recovery when one or more supported video cards are present. The company’s patented GPU acceleration reduces the time required to recover iPhone/iPad/iPod and BlackBerry backup passwords by orders of magnitude. The latest generation of ElcomSoft GPU acceleration technology supports unlimited numbers of AMD or NVIDIA boards.

Elcomsoft Phone Breaker supports an advanced dictionary attack with customizable permutations. According to multiple security researches, the majority of users choose meaningful, dictionary-based passwords that are easier for them to remember. Elcomsoft Phone Breaker is able to recover such passwords and their variations quickly and efficiently no matter which language they are. Elcomsoft Phone Breaker supports a variety of permutations of dictionary words, trying hundreds of variants for each dictionary word to ensure the best possible chance to recover the password.

Note: for local non-encrypted backups and backups downloaded from iCloud, decrypting the keychain is only possible for jailbroken 32-bit devices, and only if you have physical access to the device and can obtain the encryption key (0x835, securityd) using Elcomsoft iOS Forensic Toolkit.

Elcomsoft Phone Breaker can decrypt encrypted containers created by popular password managers including BlackBerry Password Keeper and Wallet for BlackBerry, as well as 1Password, allowing investigators accessing all of the suspect’s stored passwords.

Please note that Elcomsoft Phone Password Breaker is NOT the tool to remove iOS Activation Lock or iPhone passcode lock, unlock iPhone from the carrier, jailbreak the iPhone or remove SIM card PIN code. It is intended for recovery of backup passwords only. For more information, read the EPB manual and Phone Password Breaker FAQ.

Installing latest display driver is recommended when using GPU acceleration on NVIDIA or AMD cards.

If an option to encrypt the media card (with password) is enabled (Blackberry 6/7 only)

One or more of supported NVIDIA or AMD cards(recommended for hardware acceleration of password recovery)

Trial Limitations

Free trial version (Windows) uses all available CPUs and GPUs, but shows only first two characters of backup passwords (hiding the rest under the asterisks), and does not allow dictionary mutations (Windows version only; Mac version does not have password recovery features at all). Also, trial version (Windows and MacOS X) does not show passwords extracted from the keychain, and allows to download only a few specific categories from iCloud backup.

Release notes

Elcomsoft Phone Breaker v.8.40.29345

15 November, 2018

added support for message attachments when messages are synced with the iCloud

added (limited) support for new iCloud tokens (for accounts with 2FA)

added an ability to extract and decrypt old iCloud tokens on macOS X

bug fixes and performance improvements

Uninstallation procedure: in order to uninstall the product, follow the standard procedure via Control Panel - Programs and features or use the corresponding Unistall link from the product's folder in the Windows Start menu.

One or more of supported NVIDIA or AMD cards(recommended for hardware acceleration of password recovery)

Trial Limitations

Free trial version (Windows) uses all available CPUs and GPUs, but shows only first two characters of backup passwords (hiding the rest under the asterisks), and does not allow dictionary mutations (Windows version only; Mac version does not have password recovery features at all). Also, trial version (Windows and MacOS X) does not show passwords extracted from the keychain, and allows to download only a few specific categories from iCloud backup.

Release notes

Elcomsoft Phone Breaker v.8.40.29345

15 November, 2018

added support for message attachments when messages are synced with the iCloud

added (limited) support for new iCloud tokens (for accounts with 2FA)

added an ability to extract and decrypt old iCloud tokens on macOS X

bug fixes and performance improvements

Uninstallation procedure: in order to uninstall the product, follow the standard procedure via Control Panel - Programs and features or use the corresponding Unistall link from the product's folder in the Windows Start menu.